Syslog Smartconnector: Filters issue

during some checks I saw plenty of syslog logs from two different sources that I have to filter out from the smartconnectors side in order to prevent they can be sent to the logger.

So I found that the filter I have to fill in the "filter out" space to do so is

name CONTAINS "APPFW" OR name CONTAINS "SSL_HANDSHAKE" OR (deviceVendor IS NULL AND (name CONTAINS "Vpxa:" OR name CONTAINS "issue_cli_cmd" OR name CONTAINS "issue_cmd" OR name CONTAINS "print_args" OR name CONTAINS "message repeated" OR name CONTAINS "list_nodes"))

The thing is that if this query runs perfectly as a search on logger, it doesn't work as a filter on the smartconnectors. Any ideas?

Re: Syslog Smartconnector: Filters issue

When filtering out at the connector level you should test the filter as an active channel in ESM to see what events the filter will pick up.

If this connector is not registerd or sending to ESM it makes the job more difficult. Creating filters for connectors that are not registered with ESM involves a hack....The filter syntax that you need to use for a connector is totally different than everything else.

Your best bet is to create the filter in ESM apply it to a connector that is registered with ESM. Than ssh into that connector and look at the resulting xml config for that filter. The xml config has the filter applied to the connectors destination. Copy and paste that filter syntax into the connector you need to apply it too.

Re: Syslog Smartconnector: Filters issue

When filtering out at the connector level you should test the filter as an active channel in ESM to see what events the filter will pick up.

If this connector is not registerd or sending to ESM it makes the job more difficult. Creating filters for connectors that are not registered with ESM involves a hack....The filter syntax that you need to use for a connector is totally different than everything else.

Your best bet is to create the filter in ESM apply it to a connector that is registered with ESM. Than ssh into that connector and look at the resulting xml config for that filter. The xml config has the filter applied to the connectors destination. Copy and paste that filter syntax into the connector you need to apply it too.

Re: Syslog Smartconnector: Filters issue

The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.